linux-installer.yml

name: Build Linux native packages

on:
  push:
    tags:
      # Same scheme as release-pythinker-cli.yml and windows-installer.yml.
      - "v[0-9]+.[0-9]+.[0-9]+"
  workflow_dispatch:
    inputs:
      version:
        description: "Version to build (e.g. 0.27.0)"
        required: true
        type: string

concurrency:
  group: linux-installer-${{ github.ref }}
  cancel-in-progress: false

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x86_64
            runner: ubuntu-latest
            qemu: false
          - arch: aarch64
            runner: ubuntu-latest
            qemu: true
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2

      - name: Resolve version
        id: ver
        env:
          GITHUB_REF: ${{ github.ref }}
          INPUT_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          if [[ "$GITHUB_REF" =~ ^refs/tags/v([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then
            version="${BASH_REMATCH[1]}"
          elif [[ -n "$INPUT_VERSION" ]]; then
            version="$INPUT_VERSION"
          else
            echo "::error::No version source available" >&2
            exit 1
          fi
          echo "version=${version}" >> "$GITHUB_OUTPUT"

      - name: Set up Node.js (web build)
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # pinned from v6.4.0
        with:
          node-version: "24"
          cache: "npm"
          cache-dependency-path: web/package-lock.json

      # The web/dashboard frontends are gitignored build artifacts; without these
      # steps PyInstaller froze a binary whose web UI 404'd on "/". The
      # bundles are arch-independent, so they are built once on the host —
      # the QEMU container build picks them up from the mounted checkout.
      # The spec file now also refuses to freeze when the bundles are missing.
      - name: Build web UI bundle
        env:
          PYTHINKER_WEB_STRICT_VERSION: "1"
          PYTHINKER_WEB_EXPECT_VERSION: ${{ steps.ver.outputs.version }}
        run: python3 scripts/build_web.py

      - name: Build dashboard UI bundle
        run: python3 scripts/build_dashboard.py

      - name: Set up QEMU (aarch64 only)
        if: matrix.qemu
        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # pinned from v4.1.0
        with:
          platforms: arm64

      - name: Set up Python
        if: '!matrix.qemu'
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # pinned from v6.2.0
        with:
          python-version: "3.13"

      - name: Install build tools (native amd64)
        if: '!matrix.qemu'
        run: |
          set -euxo pipefail
          python -m pip install --upgrade pip uv
          uv sync --frozen --no-dev
          uv pip install pyinstaller
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends ruby ruby-dev rpm
          sudo gem install --no-document fpm

      - name: Build packages (native amd64)
        if: '!matrix.qemu'
        env:
          PKG_VERSION: ${{ steps.ver.outputs.version }}
          PKG_ARCH: ${{ matrix.arch }}
        run: |
          set -euxo pipefail
          export PATH="$PWD/.venv/bin:$PATH"
          bash packages/linux-installer/build.sh "$PKG_VERSION" "$PKG_ARCH"

      - name: Build packages (aarch64 via QEMU)
        if: matrix.qemu
        env:
          PKG_VERSION: ${{ steps.ver.outputs.version }}
          PKG_ARCH: ${{ matrix.arch }}
        run: |
          set -euxo pipefail
          docker run --rm --platform linux/arm64 \
            -v "$PWD:/work" -w /work \
            -e PKG_VERSION -e PKG_ARCH \
            python:3.13-slim-bookworm bash -c '
              set -euxo pipefail
              apt-get update
              apt-get install -y --no-install-recommends \
                ruby ruby-dev rpm tar gzip build-essential
              gem install --no-document fpm
              python -m pip install --upgrade pip uv
              uv sync --frozen --no-dev
              uv pip install pyinstaller
              export PATH="/work/.venv/bin:$PATH"
              bash packages/linux-installer/build.sh "$PKG_VERSION" "$PKG_ARCH"
            '

      - name: List dist artifacts
        run: ls -la dist

      - name: Upload artifact (per-arch)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # pinned from v7.0.1
        with:
          name: pythinker-linux-${{ matrix.arch }}-${{ steps.ver.outputs.version }}
          path: |
            dist/pythinker-code_*.deb
            dist/pythinker-code_*.deb.sha256
            dist/pythinker-code-*.rpm
            dist/pythinker-code-*.rpm.sha256

      - name: Attach to Release (create-or-update)
        if: startsWith(github.ref, 'refs/tags/v')
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # pinned from v3.0.0
        with:
          tag_name: ${{ github.ref_name }}
          # Mark prerelease so this tag stays OUT of /releases/latest (which is
          # date-based and ignores make_latest) if this job wins the create
          # race with only the Linux packages present. promote-release.yml
          # clears prerelease once every platform's assets are attached.
          prerelease: "true"
          fail_on_unmatched_files: false
          make_latest: "false"
          files: |
            dist/pythinker-code_*.deb
            dist/pythinker-code_*.deb.sha256
            dist/pythinker-code-*.rpm
            dist/pythinker-code-*.rpm.sha256
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}